Abstract: Disclosed are various approaches for remotely hosted management of network virtualization. In one approach, an administrative user at a client device is authenticated by a computing device for access to manage a network located remotely from the computing device. One or more commands are received from the client device to configure a software-defined networking rule for the network. The computing device communicates with one or more services on the network to implement the software-defined networking rule. A status of implementing the software-defined networking rule is reported to the client device.

Abstract: Certain embodiments described herein are directed to a method of receiving information associated with a service provided by a management plane for managing a remote network. The method, in one example, includes registering, at an adapter container, with a data store or an entity within a service instance of a service deployment associated with a service within a software-defined networking environment associated with the remote network, wherein the service is provided for managing a remote network, and wherein registering with the data store or the entity causes the data store or the entity to send information associated with the service instance to the adapter when information is available. The method also includes receiving, at the adapter container, information from the data store or the entity. The method also includes transforming the information from a first format to a second format. The method also includes transmitting the information to an endpoint.

Abstract: In accordance with an embodiment, described herein is a system and method for providing multitenancy support in a platform as a service or cloud computing environment. A platform component enables a service runtime to be shared by multiple tenants, by providing each tenant with a dedicated share or slice of a runtime instance. Each share/slice can be isolated from other shares/slices with respect to factors such as, for example, configuration, or quality of service. In accordance with an embodiment, during provisioning of a particular service runtime, a runtime definition associated with the service runtime can be utilized, for example by a service management engine, to configure the platform component to install one or more services within the service runtime. A particular service and its service runtimes can also be provisioned, within one or more runtime pools, according to a service runtime definition and placement configuration.

Abstract: In accordance with an embodiment, described herein is a system and method for supporting patching in a multi-tenant application server environment. The system can associate one or more partitions with a tenant, for use by that tenant, wherein a partition is a runtime and administrative subdivision or slice of a domain. A patching process can take advantage of high-availability features provided by an application server clustering environment, to apply patches in a controlled, rolling restart, which maintains a domain's ability to operate without interruption, or with zero downtime. The process can be used to automate complex or long running tasks, including preserving an unpatched or prior version of an application server, application, or other software component for possible rollback, or providing automatic reversion in the event of an unrecoverable error.

Abstract: Some embodiments provide a novel method for analyzing the incoming flow data to detect anomalous behavior. The analysis, in some embodiments, is performed after a deduplication/aggregation operation. In some embodiments, the analysis identifies flows for further investigation by an administrator. The analysis, in some embodiments is also performed based on other received data sets (e.g., context data and configuration data), stored flow data, or both.

Abstract: Some embodiments provide a novel method for analyzing the incoming flow data to detect anomalous behavior. The analysis, in some embodiments, is performed after a deduplication/aggregation operation. In some embodiments, the analysis identifies flows for further investigation by an administrator. The analysis, in some embodiments is also performed based on other received data sets (e.g., context data and configuration data), stored flow data, or both.

Abstract: Some embodiments provide a novel method for collecting and reporting attributes of data flows associated with machines executing on a plurality of host computers to an analysis appliance and providing visual representations of the data to a user. Some embodiments provide a visual representation of the collected data that allows a user to select a set of machines and flows and initiate recommendation generation based on the selected machines and flows. The recommendation generation, in some embodiments, includes identifying flows for which rules have not been defined and filtering the identified rules to remove flows for which rules should not be defined. Some embodiments use the identified rues to identify services and groups associated with the rules and generate recommendations for rules, groups and services based on the identified flows, groups and services. The recommendations, in some embodiments, are implemented as a single PATCH API.

Abstract: Some embodiments provide a novel method for receiving a plurality of attribute sets from a set of host computers, each attribute set associated with a group of one or more flows that is created by using a key to associate individual flows into the group of flows. The appliance, in some embodiments, merges two identified attribute sets into one merged attribute set and analyzes the merged attribute set to identify a set of properties of the flows in the groups of flows associated with the two attribute sets. In some embodiments, a visualization process includes identifying machines as members of groups and identifying machines that are connected. The visualization process, in some embodiments, also generates a graphical user interface that can be used to select groups of machines, domains, or individual machines and displays contextual attributes relevant to the selected group, domain, or machine.

Abstract: Some embodiments provide a novel method for collecting and reporting attributes of data flows associated with machines executing on a plurality of host computers to an analysis appliance and providing visual representations of the data to a user. Some embodiments provide a visual representation of the collected data that allows a user to select a set of machines and flows and initiate recommendation generation based on the selected machines and flows. The recommendation generation, in some embodiments, includes identifying flows for which rules have not been defined and filtering the identified rules to remove flows for which rules should not be defined. Some embodiments use the identified rues to identify services and groups associated with the rules and generate recommendations for rules, groups and services based on the identified flows, groups and services. The recommendations, in some embodiments, are implemented as a single PATCH API.

Abstract: Some embodiments provide a novel method for correlating configuration data received from the network manager computer with flow group records. In some embodiments, the correlation with the configuration data identifies a group associated with at least one of: (i) the source machine, (ii) destination machine, and (iii) service rules applied to the flows. The correlation with the configuration data, in some embodiments, also identifies whether a service rule applied to the flows is a default service rule. In some embodiments, the correlation with the configuration is based on a tag included in the flow group record that identifies a configuration version, and a configuration associated with the identified configuration version is used to identify the group association or the identity of the default service rule.

Abstract: Some embodiments provide a novel method for receiving a plurality of attribute sets from a set of host computers, each attribute set associated with a group of one or more flows that is created by using a key to associate individual flows into the group of flows. The appliance, in some embodiments, identifies at least two received attribute sets from two different host computers that relate to a same set of flows between a same set of source machines and a same set of destination machines. The appliance merges the two identified attribute sets into one merged attribute set and analyzes the merged attribute set to identify a set of properties of the flows in the groups of flows associated with the two identified attribute sets, in some embodiments.

Abstract: Disclosed are various approaches for remotely hosted management of network virtualization. In one approach, an administrative user at a client device is authenticated by a computing device for access to manage a network located remotely from the computing device. One or more commands are received from the client device to configure a software-defined networking rule for the network. The computing device communicates with one or more services on the network to implement the software-defined networking rule. A status of implementing the software-defined networking rule is reported to the client device.

Abstract: Behavior-based security in a datacenter includes monitoring user actions made by users in the datacenter. Behavior-based risk scores are computer for users based on their monitored actions. One or more firewall rules are generated for users based on their behavior-based risk scores. The firewall rules regulate the actions of the users.

Abstract: In accordance with an embodiment, described herein is a system and method for providing an end-to-end lifecycle in a multi-tenant application server environment. A lifecycle manager enables configuration integration across different components, for example application servers, traffic directors or load balancers, and database or other components, which may have their own partition-specific configurations. In accordance with an embodiment, the end-to-end lifecycle infrastructure includes a plugin-based mechanism which enables the different components within a multi-tenant application server environment to use a lifecycle plugin to provide their own component-specific lifecycle functionality. In accordance with an embodiment, the system includes support for a tenant onboarding functionality, which can be used to onboard a tenant for a service to a particular partition. In accordance with an embodiment, the system supports the use of a global runtime within the multi-tenant application server environment.

Abstract: In accordance with an embodiment, described herein is a system and method for supporting patching in a multi-tenant application server environment. The system can associate one or more partitions with a tenant, for use by that tenant, wherein a partition is a runtime and administrative subdivision or slice of a domain. A patching process can take advantage of high-availability features provided by an application server clustering environment, to apply patches in a controlled, rolling restart, which maintains a domain's ability to operate without interruption, or with zero downtime. The process can be used to automate complex or long running tasks, including preserving an unpatched or prior version of an application server, application, or other software component for possible rollback, or providing automatic reversion in the event of an unrecoverable error.

Abstract: In accordance with an embodiment, described herein is a system and method for supporting patching in a multi-tenant application server environment. The system can associate one or more partitions with a tenant, for use by that tenant, wherein a partition is a runtime and administrative subdivision or slice of a domain. A patching process can take advantage of high-availability features provided by an application server clustering environment, to apply patches in a controlled, rolling restart, which maintains a domain's ability to operate without interruption, or with zero downtime. The process can be used to automate complex or long running tasks, including preserving an unpatched or prior version of an application server, application, or other software component for possible rollback, or providing automatic reversion in the event of an unrecoverable error.

Abstract: In accordance with an embodiment, described herein is a system and method for providing an end-to-end lifecycle in a multi-tenant application server environment. A lifecycle manager enables configuration integration across different components, for example application servers, traffic directors or load balancers, and database or other components, which may have their own partition-specific configurations. In accordance with an embodiment, the end-to-end lifecycle infrastructure includes a plugin-based mechanism which enables the different components within a multi-tenant application server environment to use a lifecycle plugin to provide their own component-specific lifecycle functionality. In accordance with an embodiment, the system includes support for a tenant onboarding functionality, which can be used to onboard a tenant for a service to a particular partition. In accordance with an embodiment, the system supports the use of a global runtime within the multi-tenant application server environment.

Abstract: In accordance with an embodiment, described herein is a system and method for supporting multi-tenancy in an application server, cloud, on-premise, or other environment, which enables categories of components and configurations to be associated with particular application instances or partitions. Resource group templates define, at a domain level, collections of deployable resources that can be referenced from resource groups. Each resource group is a named, fully-qualified collection of deployable resources that can reference a resource group template. A partition provides an administrative and runtime subdivision of the domain, and contains one or more resource groups. Each resource group can reference a resource group template, to bind deployable resources to partition-specific values, for use by the referencing partition. A tenant of the application server or cloud environment can be associated with a partition, or applications deployed therein, for use by that tenant.

Abstract: In an embodiment, a computer-implemented method for enabling enhanced firewall rules via ARP-based annotations is described. In an embodiment, a method comprises detecting, by a hypervisor implemented in a first host, that a first process is executing on the first host. The hypervisor determines first context information for the first process, generates a first request, encapsulates the first request and the first context information in a first packet, and transmits the first packet to a central controller to cause the central controller to update the controller's table to indicate that the first process is executing on the first host. In response to receiving a second packet from the central controller and determining that the second packet comprises a first response, the hypervisor extracts second context information from the second packet and, based on the second context information, determines that a second process is executing on a second host.

Abstract: In accordance with an embodiment, described herein is a system and method for supporting multi-tenancy in an application server, cloud, on-premise, or other environment, which enables categories of components and configurations to be associated with particular application instances or partitions. Resource group templates define, at a domain level, collections of deployable resources that can be referenced from resource groups. Each resource group is a named, fully-qualified collection of deployable resources that can reference a resource group template. A partition provides an administrative and runtime subdivision of the domain, and contains one or more resource groups. Each resource group can reference a resource group template, to bind deployable resources to partition-specific values, for use by the referencing partition. A tenant of the application server or cloud environment can be associated with a partition, or applications deployed therein, for use by that tenant.